CVE-2024-37890
Denial of service when handling a request with many HTTP headers in ws
- Published
- Updated
- Reserved
- Assigned by
- GitHub_M
Description
ws is an open source WebSocket client and server for Node.js. A request with a number of headers exceeding theserver.maxHeadersCount threshold could be used to crash a ws server. The vulnerability was fixed in [email protected] (e55e510) and backported to [email protected] (22c2876), [email protected] (eeb76d3), and [email protected] (4abd8f6). In vulnerable versions of ws, the issue can be mitigated in the following ways: 1. Reduce the maximum allowed length of the request headers using the --max-http-header-size=size and/or the maxHeaderSize options so that no more headers than the server.maxHeadersCount limit can be sent. 2. Set server.maxHeadersCount to 0 so that no limit is applied.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| GitHub_MCNA (assigner) | 3.1 | High7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
| NVDNVD · Deferred | 3.1 | High7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
- EPSS (exploitation in 30 days)
- 1.4% · top 28% of all CVEs (6 Nov 2026)
- CISA SSVC
- Exploitation: poc · Automatable: yes · Technical impact: partial
The list uses the assigner's score when there is one, then CISA's, then NVD's: High 7.5.
Weakness
Affected products
websockets · ws
- affected >= 2.1.0, < 5.2.4
- affected >= 6.0.0, < 6.2.3
- affected >= 7.0.0, < 7.5.10
- affected >= 8.0.0, < 8.17.1
Affected packages
From reviewed advisories of the GitHub Advisory Database.
References (8)
- https://github.com/websockets/ws/security/advisories/GHSA-3h5v-q93c-6h6q (opens in a new tab)x_refsource_CONFIRMx_transferred
- https://github.com/websockets/ws/issues/2230 (opens in a new tab)x_refsource_MISCx_transferred
- https://github.com/websockets/ws/pull/2231 (opens in a new tab)x_refsource_MISCx_transferred
- https://github.com/websockets/ws/commit/22c28763234aa75a7e1b76f5c01c181260d7917f (opens in a new tab)x_refsource_MISCx_transferred
- https://github.com/websockets/ws/commit/4abd8f6de4b0b65ef80b3ff081989479ed93377e (opens in a new tab)x_refsource_MISCx_transferred
- https://github.com/websockets/ws/commit/e55e5106f10fcbaac37cfa89759e4cc0d073a52c (opens in a new tab)x_refsource_MISCx_transferred
- https://github.com/websockets/ws/commit/eeb76d313e2a00dd5247ca3597bba7877d064a63 (opens in a new tab)x_refsource_MISCx_transferred
- https://nodejs.org/api/http.html#servermaxheaderscount (opens in a new tab)x_refsource_MISCx_transferred
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisory GHSA-3h5v-q93c-6h6q (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://trackcve.app/cve/CVE-2024-37890)Record last updated .